I'm trying to setup my rsyslog to send logs generated by an application under /opt/appname/logs to a remote syslog server. I have already configured rsyslog to send OS level logs but wanted to see if it can also send logs of an application. I'm not sure if IncludeConfig directive works as it looks for another *.conf file.
Does the application do its logging via syslog?– MadHatterDec 16, 2013 at 14:36
I don't think so. This is a tomcat based application and dumps logs to a directory. I wanted them to be fed to a SIEM based application so that we see ALL of them on a central console.– LegoDec 16, 2013 at 14:40
Check if the application uses some established logging framework like log4j and can be configured to use syslog. That would be the best way. Otherwise +1 for Jenny D's answer with "imfile".– mschuettDec 16, 2013 at 15:30
rsyslog has support for reading from a file. This is done with the
imfile module. You need the following config:
module(load="imfile" PollingInterval="10") #needs to be done just once # needs to be done for each file you want to watch input(type="imfile" File="/path/to/file1" Tag="tag1" StateFile="statefile1" Severity="error" Facility="local7")
There's more information at the rsyslog documentation site
You can always use the old syntax:
$ModLoad imfile $InputFileName /app/your-file.log $InputFileTag your-tag $InputFileStateFile your-tag $InputFileSeverity info $InputFileFacility local7 $InputRunFileMonitor $InputFilePersistStateInterval 1000 local7.* @@remote-rsyslog-server:port
If you hook a startup script you can use can combine
tail -n 0 -F /opt/appname/logs/file | logger ...
The parameters for logger would be the priority and you could specify the remote syslog server or just use local setup and have rsyslog do the forwarding for you.
A con for this setup is that you must make sure you're tailing the log as your application starts or you'd miss records in between.
A better solution, but gives more work, would be to use something like logstash.
You configure the inputs according to your application logs, for file you can use
sincedb to have it continue from where it last stopped and you have a module to output to syslog.
Depending on what you want this might be too much work.